0

domain AD on windows 2008 R2, linux server alfresco 3.4c, windows-7 client. I'm trying to get automatically logged into alfresco from the windows-7 client.

I've looked with wireshark to see what happens:
1. Client goes to /alfresco
2. Server sends Redirect to page
3. Client goes to Redirected page
4. Server sends a WWW-Authenticate: Negotiate header
5. Client DOES NOT respond to this

how can i configure the windows-7 client (or the AD domain) so that the client will in fact engage with the SPNEGO protocol? instead of just asking for user credentials? (the user is logged in through kerberos in the domain.)

Edit: I don't know if this is related but when logging off/on it seems there is no more traffic between client and AD. while i would think at least it should check the credentials... (since the windows-7 should be in the domain)

Also, the IE have the server in local sites.

Someone mentioned that there is a klist command on windows-7.

Maarten
  • 11
  • 5

2 Answers2

0

For IE 6-8 you need to have the site(s) in Options -> Security -> Local intranet -> Sites.

Firefox go to about:config, filter: network.negotiate-auth.trusted-uris, change to .youdomain.tld, .youseconddomain.tld

Edit: Also make sure the DNS-pointer is an A and not CNAME as windows, belive it or not (atleast in my experience), then provides a kerberos ticket for the final A-pointer.

Kerbtray is a useful tool for debugging the clientside.

Assuming you use Apache as webserver, setting loglevel debug in you vhost conf might give you a clue to what is/isn't happening.

Mark
  • 740
  • 5
  • 5
  • I'm using the windows DNS service itself, and it's an A record. I'm not using apache, but connecting to the bundled tomcat at port 8080 directly. I'm using wireshark to see what is happening, but i'll take a look at this kerbtray thing. – Maarten Mar 03 '11 at 09:54
0

apparently there was too much fiddling done with the AD and the windows-7 client, i reinstalled both and redone the keytabs and now it works for both HTTP and CIFS

Maarten
  • 11
  • 5
  • Hum. In such case, there is a high chance your SPN has been set on multiple service accounts. The `setspn -X` command is here to help detect such troubles, and then fix them with `setspn -d` – Yves Martin Nov 20 '14 at 16:03